CVE-2026-88984: RBAC Authorization Bypass in Kubeflow Pipelines Multi-User API Server

Vulnerability ID: CVE-2026-88984
CVSS Score: 7.2
Published: 2026-11-09

CVE-2026-88984 (GHSA-ghgh-57qv-h687) is an incorrect authorization vulnerability affecting Kubeflow Pipelines (KFP) prior to version 2.16.1 in multi-user deployments. The multi-user API server treats the empty Kubernetes namespace associated with shared or global pipelines as an unconditional authorization exception across all API verbs. Consequently, any authenticated user can modify, overwrite, or delete shared pipeline definitions and pipeline versions without possessing the required Kubernetes RBAC permissions, compromising the integrity and availability of global machine learning workflows.

TL;DR

An authorization bypass in the Kubeflow Pipelines (< 2.16.1) multi-user API server allows any authenticated user to modify or delete shared (global) pipelines and pipeline versions because the server unconditionally skips Kubernetes RBAC checks when a pipeline's namespace is empty.

Technical Details

• CVE ID: CVE-2026-88984 (GHSA-ghgh-57qv-h687)
• Vulnerability Class: CWE-863: Incorrect Authorization / CWE-285: Improper Authorization
• CVSS v4.0 Score: 7.2 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N)
• EPSS Score: 0.31% (24.09th Percentile)
• Attack Vector: Network (Authenticated Low-Privileged Tenant via KFP Multi-User API)
• Security Impact: Unauthorized Modification and Deletion of Shared/Global Pipelines
• Affected Versions: Kubeflow Pipelines < 2.16.1
• CISA KEV Status: Not Listed

Affected Systems

• Kubeflow Pipelines (multi-user deployments)
• ghcr.io/kubeflow/kfp-api-server
• Kubeflow Pipelines: >= 2.0.2, < 2.16.1 (Fixed in: 2.16.1)

Code Analysis

Commit: 186dd1f

fix(backend): enforce pipeline authorization (#13288)

--- a/backend/src/apiserver/server/pipeline_server.go
+++ b/backend/src/apiserver/server/pipeline_server.go
@@ -1262,8 +1262,21 @@ func (s *BasePipelineServer) canAccessPipeline(ctx context.Context, pipelineId s
            resourceAttributes.Name = pipeline.Name
        }
    }
-   // Skip authentication if the namespace is empty to enable shared pipelines in multi-user mode
+   // Skip authorization for read-only operations on shared pipelines in multi-user mode.
+   // Write operations (create, update, delete) on shared pipelines must still be authorized
+   // against the KFP system namespace, since shared pipelines have no namespace of their own.
    if s.resourceManager.IsEmptyNamespace(resourceAttributes.Namespace) {
+       if resourceAttributes.Verb == common.RbacResourceVerbGet || resourceAttributes.Verb == common.RbacResourceVerbList {
+           return nil
+       }
+       resourceAttributes.Namespace = common.GetPodNamespace()
+       resourceAttributes.Group = common.RbacPipelinesGroup
+       resourceAttributes.Version = common.RbacPipelinesVersion
+       resourceAttributes.Resource = common.RbacResourceTypePipelines
+       err := s.resourceManager.IsAuthorized(ctx, resourceAttributes)
+       if err != nil {
+           return util.Wrapf(err, "Failed to access shared pipeline %s. Check if you have permission to %s shared pipelines", pipelineId, resourceAttributes.Verb)
+       }
        return nil
    }
    resourceAttributes.Group = common.RbacPipelinesGroup

Mitigation Strategies

• Upgrade Kubeflow Pipelines to version 2.16.1 or later to enforce Kubernetes SubjectAccessReview checks against the KFP system namespace for mutating operations on shared pipelines.
• Configure explicit Kubernetes RoleBindings in the KFP installation namespace (e.g., 'kubeflow') for legitimate administrators or CI/CD service accounts that require write access to global pipelines.
• Deploy Istio AuthorizationPolicy or API gateway rules to restrict mutating HTTP methods (POST, PUT, DELETE, PATCH) on pipeline management and multipart upload endpoints (/apis/v1beta1/pipelines/upload*) to trusted administrative identities.
• Audit the KFP metadata database and Envoy/API server access logs for unauthorized pipeline version injections or deletions targeting shared pipelines with empty namespaces.

Remediation Steps:

1. Identify the current Kubeflow Pipelines version deployed in the cluster by checking the image tag on the 'ml-pipeline' deployment in the 'kubeflow' namespace.
2. Update the KFP manifests or Kustomize overlays to use release 2.16.1 (specifically updating 'ghcr.io/kubeflow/kfp-api-server:2.16.1', 'ghcr.io/kubeflow/kfp-driver:2.16.1', and 'ghcr.io/kubeflow/kfp-launcher:2.16.1').
3. Apply a Kubernetes RoleBinding in the KFP system namespace binding the 'kubeflow-edit' ClusterRole to any specific User or ServiceAccount subjects responsible for publishing or maintaining shared pipelines.
4. Verify the fix by attempting to delete or create a version on a shared pipeline using a standard tenant user token and confirming that the API server returns an authorization error referencing the KFP system namespace.

References

• GitHub Security Advisory GHSA-ghgh-57qv-h687
• Kubeflow Pipelines Pull Request #13288: fix(backend): enforce pipeline authorization
• Fix Commit 186dd1f3b0403af841c9b4ea7ab94f405339ef6c
• Kubeflow Pipelines Release 2.16.1
• Official CVE.org Record for CVE-2026-88984
• NVD Vulnerability Detail for CVE-2026-88984

Read the full report for CVE-2026-88984 on our website for more details including interactive diagrams and full exploit analysis.